News for hackers. Stuff that matters.

A comment on Google hits undo on limiting JavaScript capabilities in cross-origin iframes. Parent comment

Re:Google hits undo on limiting JavaScript capabilities in c... by ceronman on Thursday August 05, 2021 @05:11AM (#28071438)
It would still break sites like codepen.io that use iframes for this.
[ Parent | on HN ]
Re:Google hits undo on limiting JavaScript capabilities in c... by gregoriol on Thursday August 05, 2021 @05:15AM (#28071460)
codepen's iframes are their own, not cross-origin
[ Parent | on HN ]
Re:Google hits undo on limiting JavaScript capabilities in c... by mcintyre1994 on Thursday August 05, 2021 @05:24AM (#28071503)
They're on another domain they own, but they are on another domain (cdpn.io) and the cross-origin concern does apply. They do that because they have auth cookies on codepen.io and don't want them exposed to the iframe.

See these tweets by their cofounder: https://twitter.com/chriscoyier/status/1422940724295786503?s... and https://twitter.com/chriscoyier/status/1420033471376920578?s...

[ Parent | on HN ]
Re:Google hits undo on limiting JavaScript capabilities in c... by asddubs on Thursday August 05, 2021 @05:27AM (#28071513)
if they were on the same domain you could load iframes with the parent site and do arbitrary CSRF
[ Parent | on HN ]